<?php
if (preg_match('/(<entry id="$cve">.+?<\/entry>)/ism', $nvdcve_lists[$cve_year], $cve_match)) {
        // do stuff
}
?>

$cve_year == 2009
$cve == "CVE-2009-3826"
$nvdcve_lists[$cve_year] == (udpluk):
(...)
    <entry id="CVE-2009-3826">
        <vuln:cve-id>CVE-2009-3826</vuln:cve-id>
        <vuln:published-datetime>2009-10-28T10:30:00.297-04:00</vuln:published-datetime>
        <vuln:last-modified-datetime>2009-10-28T10:30:00.297-04:00</vuln:last-modified-datetime>
        <vuln:references xml:lang="en" reference_type="UNKNOWN">
            <vuln:source>XF</vuln:source>
(...)